Junglewise Threat Intelligence

CVE-2025-38498: Linux Kernel denial of service in do_change_type mount handling

CVE-2025-38498 · Severity: medium · CVSS 5.5 · Published 2025-07-30

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's filesystem management could allow a local user to interfere with system stability. By manipulating mount settings that should be restricted to other parts of the system, an attacker could potentially cause a denial-of-service condition. This issue affects how the system handles shared folders and disk drives across different isolated environments (namespaces).

Technical details

A vulnerability was identified in the do_change_type() function within fs/namespace.c of the Linux kernel. The function failed to verify if a mount belonged to the caller's mount namespace before allowing changes to its propagation settings (e.g., MS_SHARED). By invoking mount(2) on unmounted or foreign mounts, a local attacker with standard privileges could bypass intended namespace isolation. This could lead to a denial-of-service (DoS) by corrupting mount states or exhausting resources. The fix introduces a check_mnt() call to ensure the mount is valid and owned by the caller's namespace before proceeding with type changes.

Affected products

  • Linux Linux Kernel 2.6.15 to 5.4.295, 5.5 to 5.10.239, 5.11 to 5.15.186, 5.16 to 6.1.142, 6.2 to 6.6.94, 6.7 to 6.12.34, 6.13 to 6.15.3

Timeline

  • 2025-07-30: disclosed
  • 2025-07-30: advisory
  • 2025-06-07: patched: Initial patch commit in Linux stable tree

References

Related threats